c - 加载库需要随机化内存地址是什么？

Question

ldd在运行时显示共享库链接的内存地址

$ cat one.c 
#include<stdio.h>

int main() {
    printf ("%d", 45);
}
$ gcc one.c -o one -O3
$ ldd one
    linux-gate.so.1 =>  (0x00331000)
    libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0x00bc2000)
    /lib/ld-linux.so.2 (0x006dc000)
$

来自 this answer另一个问题，

... The addresses are basically random numbers. Before secure implementations were devised, ldd would consistently indicate the memory addresses where the program sections were loaded. Since about five years ago, many flavors of Linux now intentionally randomize load addresses to frustrate would-be virus writers, etc.

我不完全理解这些内存地址如何被用于漏洞利用。

问题是否类似于“如果地址是固定的，可以在该地址放置一些不需要的代码，这些代码将被链接起来，就好像它是一个库”，还是比这个更复杂？

Answer 1

"If the addresses are fixed, one can put some undesirable code at that address which would be linked as if it was a library"

是的。

还有。缓冲区溢出攻击需要一致的内存模型，以便溢出缓冲区的字节对代码的已知部分做已知的事情。

http://www.corewars.org/很好地说明了这一原则。